Missing Authorization in Keycloak - CVE-2026-18571
Published: August 2, 2026 / Updated: September 5, 2026
Vulnerability identifier: #VU146978
CSH Severity: Low
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18571
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to grant newly created users elevated privileges.
The vulnerability exists due to missing authorization in the user creation component when Fine-Grained Admin Permissions V2 is enabled. A remote privileged user can create users and add them to groups they are not authorized to manage to grant newly created users elevated privileges.
Affected software
Keycloak
How to mitigate CVE-2026-18571
Install security update from vendor's website.
Keycloak - update to 26.7.3